Spring：ログイン後の役割ベースのリダイレクト

Question

私は3つのユーザーロール{ADMIN、MANAGER、EMPLOYEE}を持っています。それはすでに、例えば、管理者は/ admin/**などにアクセスできます。しかし、私が本当にやりたいことは、ADMINというロールでログインしたユーザーが、 welcome2.xhtmlと役割を持たない他のすべてのユーザーADMINは、 welcome.xhtml。

私は既に持っているコードの下にあります。

http.authorizeRequests() 
       //Permit access to the H2 console 
       .antMatchers("/h2-console/**").permitAll() 
       //Permit access for all to error pages 
       .antMatchers("/error/**") 
       .permitAll() 
       // Only access with admin role 
       .antMatchers("/admin/**") 
       .hasAnyAuthority("ADMIN") 
       //Permit access only for some roles 
       .antMatchers("/secured/**") 
       .hasAnyAuthority("ADMIN", "MANAGER", "EMPLOYEE") 
       //If user doesn't have permission, forward him to login page 
       .and() 
       .formLogin() 
       .loginPage("/login.xhtml") 
       .loginProcessingUrl("/login") 
       .defaultSuccessUrl("/secured/welcome.xhtml"); 

Answer 1

ロールをチェックし、適切なページにリダイレクトするカスタム認証成功ハンドラが必要です。このような何かを試してみてください：

public class MySimpleUrlAuthenticationSuccessHandler implements AuthenticationSuccessHandler { 

    protected Log logger = LogFactory.getLog(this.getClass()); 

    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy(); 

    @Override 
    public void onAuthenticationSuccess(HttpServletRequest request, 
     HttpServletResponse response, Authentication authentication) 
     throws IOException { 

     handle(request, response, authentication); 
     clearAuthenticationAttributes(request); 
    } 

    protected void handle(HttpServletRequest request, 
     HttpServletResponse response, Authentication authentication) 
     throws IOException { 

     String targetUrl = determineTargetUrl(authentication); 

     if (response.isCommitted()) { 
      logger.debug(
       "Response has already been committed. Unable to redirect to " 
       + targetUrl); 
      return; 
     } 

     redirectStrategy.sendRedirect(request, response, targetUrl); 
    } 

    protected String determineTargetUrl(Authentication authentication) {   
     boolean isAdmin = false; 
     boolean isManager = false; 
     boolean isEmployee = false; 
     Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities(); 
     for (GrantedAuthority grantedAuthority : authorities) { 
      if (grantedAuthority.getAuthority().equals("ROLE_ADMIN")) { 
       isAdmin = true; 
       break; 
      } else if (grantedAuthority.getAuthority().equals("ROLE_MANAGER")) { 
       isManager = true; 
       break; 
      } else if (grantedAuthority.getAuthority().equals("ROLE_EMPLOYEEE")) { 
       isEmployee = true; 
       break; 
      } 
     } 

     if (isAdmin) { 
      return "/welcome2.xhtml"; 
     } else if (isManager) { 
      return "/welcome.xhtml"; 
     } else if (isEmployee) { 
      return "/welcome.xhtml"; 
     } else { 
      throw new IllegalStateException(); 
     } 
    } 

    protected void clearAuthenticationAttributes(HttpServletRequest request) { 
     HttpSession session = request.getSession(false); 
     if (session == null) { 
      return; 
     } 
     session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION); 
    } 

    public void setRedirectStrategy(RedirectStrategy redirectStrategy) { 
     this.redirectStrategy = redirectStrategy; 
    } 
    protected RedirectStrategy getRedirectStrategy() { 
     return redirectStrategy; 
    } 
} 

をそして、あなたの設定で

http.authorizeRequests() 
       //Permit access to the H2 console 
       .antMatchers("/h2-console/**").permitAll() 
       //Permit access for all to error pages 
       .antMatchers("/error/**") 
       .permitAll() 
       // Only access with admin role 
       .antMatchers("/admin/**") 
       .hasAnyAuthority("ADMIN") 
       //Permit access only for some roles 
       .antMatchers("/secured/**") 
       .hasAnyAuthority("ADMIN", "MANAGER", "EMPLOYEE") 
       //If user doesn't have permission, forward him to login page 
       .and() 
       .formLogin() 
       .loginPage("/login.xhtml") 
       .loginProcessingUrl("/login") 
       .defaultSuccessUrl("/secured/welcome.xhtml").successHandler(successHandler()) ; 

@Bean 
public AuthenticationSuccessHandler successHandler() { 
    return new MySimpleUrlAuthenticationSuccessHandler(); 
}